@tangle-network/agent-profile-materialize 1.1.7 → 1.1.8

package/dist/secret-concurrent-revision.js

@@ -1,249 +0,0 @@
-import { execFileSync } from "node:child_process";
-import { createHash, createHmac } from "node:crypto";
-import { chmodSync, lstatSync, mkdirSync, readdirSync } from "node:fs";
-import { join } from "node:path";
-import { agentProfileSecretRefSchema, } from "@tangle-network/agent-interface";
-import { assertLaunchRoot, prepareExplicitOpenCodePlan, publishConcurrentProfileRevision, } from "./managed-workspace.js";
-import { bindConcurrentLaunch } from "./managed-workspace-bind.js";
-import { prepareManagedWorkspacePlan } from "./managed-workspace-stage.js";
-import { normalizeWorkspacePlanArgument } from "./plan-normalize.js";
-import { assertWorkspacePlanSupported } from "./plan-support.js";
-/** Refuse an executor that cannot isolate the revision, or a plan that claims its launch names. */
-function assertSecretRevisionLaunch(input) {
-    if (process.platform !== "linux" ||
-        process.getuid?.() !== 0 ||
-        !Number.isSafeInteger(input.subprocessUid) ||
-        input.subprocessUid < 200_000 ||
-        input.namingKey.length !== 32 ||
-        !input.ownerId) {
-        throw new Error("Secret concurrent profile needs a root executor and reserved identity");
-    }
-    for (const name of [
-        "OPENCODE_DISABLE_PROJECT_CONFIG",
-        "OPENCODE_CONFIG_DIR",
-        "TANGLE_SHARED_WORKSPACE",
-        "TANGLE_PROFILE_REVISION_WORKSPACE",
-    ]) {
-        if (Object.hasOwn(input.plan.env, name)) {
-            throw new Error(`Secret ${input.plan.harness} reserves ${name} for its launch binding`);
-        }
-    }
-}
-/**
- * The OpenCode plan the revision materializes: the trusted provider config
- * merged in, and every public MCP header turned into a reference.
- */
-function secretOpenCodePlan(sourcePlan, providerConfig, secretReferences) {
-    // Workspace `reference/` files stay in this revision's read-only tree. The
-    // sealed launch runs from that tree, so a cwd-relative `reference/` path
-    // reads this revision's copy and nothing is written to the shared workspace.
-    let plan = prepareExplicitOpenCodePlan(sourcePlan);
-    if (providerConfig) {
-        plan = {
-            ...plan,
-            files: plan.files.map((file) => file.relPath === "opencode.json" &&
-                file.source === "generated" &&
-                (file.root ?? "workspace") === "workspace"
-                ? {
-                    ...file,
-                    content: JSON.stringify({
-                        ...JSON.parse(file.content),
-                        provider: providerConfig,
-                    }),
-                }
-                : file),
-        };
-    }
-    plan = referencePublicMcpHeaders(plan, secretReferences);
-    if (plan.files.some((file) => file.relPath.startsWith(".config/opencode/"))) {
-        throw new Error("Secret OpenCode reserves its native config directory");
-    }
-    // OpenCode and every process it spawns run as the session UID, so a value in
-    // its environment, argv or config is readable by the agent's own shell
-    // (`/proc/<pid>/environ`, `/proc/<pid>/cmdline`, `cat`). No profile secret
-    // value may reach the launch: config slots stay references whose values the
-    // launch never receives (#11875).
-    if (Object.values(plan.env).some((value) => typeof value !== "string") ||
-        plan.flags.some((argument) => typeof normalizeWorkspacePlanArgument(argument) !== "string")) {
-        throw new Error("Secret OpenCode refuses a profile secret in its launch environment or arguments");
-    }
-    return plan;
-}
-/** Codex's native readback identifies which held values belong to MCP servers. */
-async function secretCodexPlan(plan, references, provider) {
-    const env = { ...plan.env };
-    for (const [variable, value] of Object.entries(env)) {
-        if (/^(?:CODEX_|XDG_|HOME$)/u.test(variable)) {
-            throw new Error(`Secret Codex reserves ${variable} for its launch binding`);
-        }
-        if (typeof value === "string" && !variable.startsWith("TANGLE_MCP_HEADER_"))
-            continue;
-        const ref = typeof value === "string"
-            ? undefined
-            : agentProfileSecretRefSchema.parse(value);
-        const raw = ref ? await provider.get(ref.key) : value;
-        if (typeof raw !== "string" || !raw.trim())
-            throw new Error("Secret Codex MCP value is unavailable");
-        const name = `${HELD_VALUE_PREFIX}${createHash("sha256").update(`codex-mcp-env\0${variable}`).digest("hex").slice(0, 24).toUpperCase()}`;
-        references[name] = ref?.format === "bearer" ? `Bearer ${raw}` : raw;
-        env[variable] = `{env:${name}}`;
-    }
-    if (plan.flags.some((argument) => typeof normalizeWorkspacePlanArgument(argument) !== "string")) {
-        throw new Error("Secret Codex refuses a profile secret in native arguments");
-    }
-    return { ...plan, env };
-}
-/**
- * Publish a resolved revision for exactly one native subprocess UID. The
- * executor-owned naming key hides low-entropy credential guesses from paths;
- * the resolved digest and manifest never leave this server-side result.
- */
-export async function prepareSecretConcurrentProfileRevision(input) {
-    assertSecretRevisionLaunch(input);
-    const secretReferences = {};
-    if (input.plan.harness !== "codex" && input.plan.harness !== "opencode") {
-        throw new Error("Secret profile has no verified native launch binding");
-    }
-    const plan = input.plan.harness === "codex"
-        ? await secretCodexPlan(input.plan, secretReferences, input.secretProvider)
-        : secretOpenCodePlan(input.plan, input.providerConfig, secretReferences);
-    assertWorkspacePlanSupported(plan);
-    assertLaunchRoot(input.launchRoot);
-    // File slots reference their secrets, so an unchanged profile with a rotated
-    // per-turn secret reuses this revision.
-    const prepared = await prepareManagedWorkspacePlan(plan, input.managedRoot, input.sharedWorkspaceDir, input.secretProvider, { ...input.options, secretFileSlotReferences: secretReferences });
-    const identity = createHmac("sha256", input.namingKey)
-        .update(input.sharedWorkspaceDir)
-        .update("\0")
-        .update(input.ownerId)
-        .update("\0")
-        .update(String(input.subprocessUid))
-        .update("\0")
-        .update(prepared.manifest.materializedDigest)
-        .digest("hex");
-    const revision = publishConcurrentProfileRevision(prepared, join(input.launchRoot, `revision-${identity}`), (directory) => {
-        // OpenCode's sealed XDG tree never reads authority from native HOME.
-        if (plan.harness === "opencode")
-            for (const relPath of [".config/opencode", ".opencode"]) {
-                mkdirSync(join(prepared.root, "workspace", relPath), {
-                    recursive: true,
-                    mode: 0o700,
-                });
-            }
-        const bound = bindConcurrentLaunch(plan, prepared.application, join(directory, "workspace"), { secretRevision: true });
-        return {
-            ...bound,
-            env: {
-                ...bound.env,
-                ...(plan.harness === "opencode"
-                    ? {
-                        OPENCODE_DISABLE_PROJECT_CONFIG: "1",
-                        OPENCODE_CONFIG_DIR: join(directory, "workspace", ".opencode"),
-                    }
-                    : {
-                        TANGLE_PROFILE_REVISION_WORKSPACE: join(directory, "workspace"),
-                    }),
-                TANGLE_SHARED_WORKSPACE: input.sharedWorkspaceDir,
-            },
-        };
-    }, (root) => makeSecretRevisionReadOnly(root, input.subprocessUid), true);
-    return { ...revision, secretReferences };
-}
-const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
-/** How `servableMcpServer` recognizes a header value the executor holds. */
-const HELD_VALUE_PREFIX = "TANGLE_PROFILE_SECRET_";
-/**
- * A remote MCP server's public header values never reach the sealed launch:
- * the executor's loopback proxy replaces the server's url and headers there.
- * They did reach the revision's bytes, so a value that changes every turn (a
- * run id, a message id) gave each turn its own digest, revision directory,
- * receipt and native health check. Each such value becomes a reference the
- * executor resolves, as a secret slot already does, and the revision names
- * only the header. The value stays as public as the profile declared it; it is
- * held beside the secret references and nothing the native process can read
- * carries it.
- *
- * A value that already looks like a reference, or is empty, stays in place.
- */
-function referencePublicMcpHeaders(plan, references) {
-    const configFile = plan.files.find((file) => file.relPath === "opencode.json" &&
-        file.source === "generated" &&
-        (file.root ?? "workspace") === "workspace");
-    if (!configFile)
-        return plan;
-    const config = JSON.parse(configFile.content);
-    if (!isRecord(config) || !isRecord(config.mcp))
-        return plan;
-    let changed = false;
-    for (const [server, entry] of Object.entries(config.mcp)) {
-        if (!isRecord(entry) || entry.type !== "remote")
-            continue;
-        if (!isRecord(entry.headers))
-            continue;
-        for (const [header, value] of Object.entries(entry.headers)) {
-            if (typeof value !== "string" || value === "")
-                continue;
-            if (/\{(?:env|file):/.test(value))
-                continue;
-            const name = `${HELD_VALUE_PREFIX}${createHash("sha256")
-                .update(`public-mcp-header\0${server}\0${header}`, "utf8")
-                .digest("hex")
-                .slice(0, 24)
-                .toUpperCase()}`;
-            references[name] = value;
-            entry.headers[header] = `{env:${name}}`;
-            changed = true;
-        }
-    }
-    if (!changed)
-        return plan;
-    return {
-        ...plan,
-        files: plan.files.map((file) => file === configFile ? { ...file, content: JSON.stringify(config) } : file),
-    };
-}
-function secretRevisionPaths(root) {
-    const all = [root];
-    const exposed = [root];
-    const walk = (directory) => {
-        for (const entry of readdirSync(directory, { withFileTypes: true })) {
-            const child = join(directory, entry.name);
-            const stat = lstatSync(child);
-            if (stat.uid !== 0 || stat.isSymbolicLink()) {
-                throw new Error("Secret concurrent profile stage contains an untrusted inode");
-            }
-            if (!stat.isDirectory() && !stat.isFile()) {
-                throw new Error("Secret concurrent profile stage contains a special file");
-            }
-            all.push(child);
-            if (entry.name !== "manifest.json" || directory !== root) {
-                exposed.push(child);
-            }
-            if (stat.isDirectory())
-                walk(child);
-        }
-    };
-    walk(root);
-    return { all, exposed };
-}
-export function runSetfacl(args, paths) {
-    for (let start = 0; start < paths.length; start += 64) {
-        execFileSync("/usr/bin/setfacl", [...args, "--", ...paths.slice(start, start + 64)], {
-            env: { PATH: "/usr/bin:/bin", LANG: "C" },
-            timeout: 30_000,
-            stdio: "pipe",
-        });
-    }
-}
-function makeSecretRevisionReadOnly(root, uid) {
-    const paths = secretRevisionPaths(root);
-    // Remove inherited named ACLs before widening the ACL mask for this UID.
-    runSetfacl(["-b"], paths.all);
-    for (const path of paths.all) {
-        const stat = lstatSync(path);
-        chmodSync(path, stat.isDirectory() ? 0o500 : stat.mode & 0o111 ? 0o500 : 0o400);
-    }
-    // The private manifest has resolved-file hashes. The CLI can read its native
-    // files, but never the executor inventory or another revision's files.
-    runSetfacl(["-m", `u:${uid}:r-X`], paths.exposed);
-}

package/dist/secret-session-view.d.ts

@@ -1,25 +0,0 @@
-/**
- * The stable, sealed cwd of one secret session. Native resume keeps this path
- * while each turn's revision changes. Its name binds the workspace, session
- * and subprocess UID, so two sessions never share a view.
- */
-export declare function secretSessionViewWorkspace(input: {
-    launchRoot: string;
-    sharedWorkspaceDir: string;
-    sessionId: string;
-    subprocessUid: number;
-}): string;
-/**
- * Bind every supplied workspace resource at its literal path, using the same
- * root-owned, read-only inode and ACL as the published revision. Generated
- * native configuration stays bound by absolute path, outside this cwd.
- *
- * The caller serializes a session's turns and binds before spawning: replacing
- * a cwd while a previous native process still reads it is not supported.
- */
-export declare function bindSecretSessionView(input: {
-    launchRoot: string;
-    viewWorkspaceDir: string;
-    revisionWorkspaceDir: string;
-    subprocessUid: number;
-}): void;

package/dist/secret-session-view.js

@@ -1,166 +0,0 @@
-import { createHash, randomBytes } from "node:crypto";
-import { chmodSync, linkSync, lstatSync, mkdirSync, readdirSync, readFileSync, realpathSync, renameSync, rmSync, } from "node:fs";
-import { basename, dirname, join } from "node:path";
-import { assertLaunchRoot, assertPublishedRevision, } from "./managed-workspace.js";
-import { runSetfacl } from "./secret-concurrent-revision.js";
-import { normalizeWorkspaceRelativePath } from "./workspace-files.js";
-/**
- * The stable, sealed cwd of one secret session. Native resume keeps this path
- * while each turn's revision changes. Its name binds the workspace, session
- * and subprocess UID, so two sessions never share a view.
- */
-export function secretSessionViewWorkspace(input) {
-    if (!input.sessionId)
-        throw new Error("Secret session view needs a session");
-    const name = createHash("sha256")
-        .update("tangle-secret-session-view\0")
-        .update(input.sharedWorkspaceDir)
-        .update("\0")
-        .update(input.sessionId)
-        .update("\0")
-        .update(String(input.subprocessUid))
-        .digest("hex");
-    return join(input.launchRoot, `session-${name}`, "workspace");
-}
-/**
- * Bind every supplied workspace resource at its literal path, using the same
- * root-owned, read-only inode and ACL as the published revision. Generated
- * native configuration stays bound by absolute path, outside this cwd.
- *
- * The caller serializes a session's turns and binds before spawning: replacing
- * a cwd while a previous native process still reads it is not supported.
- */
-export function bindSecretSessionView(input) {
-    const { launchRoot, viewWorkspaceDir, revisionWorkspaceDir } = input;
-    if (process.platform !== "linux" ||
-        process.getuid?.() !== 0 ||
-        !Number.isSafeInteger(input.subprocessUid) ||
-        input.subprocessUid < 200_000) {
-        throw new Error("Secret session view needs a root executor and reserved identity");
-    }
-    assertLaunchRoot(launchRoot);
-    const viewRoot = dirname(viewWorkspaceDir);
-    if (!isLaunchWorkspace(launchRoot, viewWorkspaceDir, /^session-[a-f0-9]{64}$/)) {
-        throw new Error("Secret session view is not a launch-root session path");
-    }
-    const revisionRoot = dirname(revisionWorkspaceDir);
-    const manifestPath = join(revisionRoot, "manifest.json");
-    if (!isLaunchWorkspace(launchRoot, revisionWorkspaceDir, /^revision-[a-f0-9]{64}$/) ||
-        realpathSync(revisionWorkspaceDir) !== revisionWorkspaceDir ||
-        !isSealedNode(lstatSync(revisionRoot), "directory") ||
-        !isSealedNode(lstatSync(revisionWorkspaceDir), "directory") ||
-        !isSealedNode(lstatSync(manifestPath), "file")) {
-        throw new Error("Secret session view needs a published revision");
-    }
-    const manifest = JSON.parse(readFileSync(manifestPath, "utf8"));
-    for (const file of manifest.files) {
-        if (!["workspace", "agent"].includes(file.root) ||
-            normalizeWorkspaceRelativePath(file.relPath) !== file.relPath) {
-            throw new Error("Secret revision resource path is not canonical");
-        }
-    }
-    assertPublishedRevision(revisionRoot, manifest, 0);
-    const current = lstatIfPresent(viewRoot);
-    if (!current)
-        mkdirSync(viewRoot, { mode: 0o700 });
-    else if (!current.isDirectory() ||
-        current.isSymbolicLink() ||
-        current.uid !== 0 ||
-        (current.mode & 0o022) !== 0) {
-        throw new Error("Secret session view is not an executor-owned directory");
-    }
-    const workspace = lstatIfPresent(viewWorkspaceDir);
-    if (workspace) {
-        if (!isSealedNode(workspace, "directory")) {
-            throw new Error("Secret session view is not an executor-owned directory");
-        }
-        assertSealedTree(viewWorkspaceDir);
-    }
-    // An interrupted bind leaves its staging/retired tree beside workspace.
-    clearBesideWorkspace(viewRoot);
-    const staged = besideWorkspace(viewRoot, "stage");
-    const retired = besideWorkspace(viewRoot, "retired");
-    mkdirSync(staged, { mode: 0o700 });
-    const directories = new Set([staged]);
-    try {
-        for (const file of manifest.files) {
-            if (file.root !== "workspace" || file.source !== "user")
-                continue;
-            const relative = file.relPath;
-            const source = join(revisionWorkspaceDir, relative);
-            let ancestor = dirname(source);
-            while (ancestor !== revisionRoot) {
-                if (!isSealedNode(lstatSync(ancestor), "directory")) {
-                    throw new Error("Secret revision resource has an unsealed ancestor");
-                }
-                ancestor = dirname(ancestor);
-            }
-            const target = join(staged, relative);
-            mkdirSync(dirname(target), { recursive: true, mode: 0o700 });
-            linkSync(source, target);
-            ancestor = dirname(target);
-            while (ancestor !== staged) {
-                directories.add(ancestor);
-                ancestor = dirname(ancestor);
-            }
-        }
-        sealDirectories([...directories], input.subprocessUid);
-        if (lstatIfPresent(viewWorkspaceDir))
-            renameSync(viewWorkspaceDir, retired);
-        try {
-            renameSync(staged, viewWorkspaceDir);
-        }
-        catch (error) {
-            if (lstatIfPresent(retired))
-                renameSync(retired, viewWorkspaceDir);
-            throw error;
-        }
-        sealDirectories([viewRoot], input.subprocessUid);
-        clearBesideWorkspace(viewRoot);
-    }
-    finally {
-        rmSync(staged, { recursive: true, force: true });
-    }
-}
-/** A fresh staged or retired path beside the view's workspace. */
-function besideWorkspace(viewRoot, kind) {
-    return join(viewRoot, `.${kind}-${randomBytes(8).toString("hex")}`);
-}
-function isLaunchWorkspace(launchRoot, workspace, name) {
-    return (basename(workspace) === "workspace" &&
-        dirname(dirname(workspace)) === launchRoot &&
-        name.test(basename(dirname(workspace))));
-}
-function lstatIfPresent(path) {
-    return lstatSync(path, { throwIfNoEntry: false });
-}
-function isSealedNode(stat, kind) {
-    return (!stat.isSymbolicLink() &&
-        (kind === "directory" ? stat.isDirectory() : stat.isFile()) &&
-        stat.uid === 0 &&
-        (stat.mode & 0o222) === 0);
-}
-function assertSealedTree(root) {
-    const stat = lstatSync(root);
-    if (isSealedNode(stat, "directory")) {
-        for (const name of readdirSync(root))
-            assertSealedTree(join(root, name));
-    }
-    else if (!isSealedNode(stat, "file")) {
-        throw new Error("Secret session view holds an unexpected or unsealed entry");
-    }
-}
-/** Root-owned, read-only, and traversable only by the session's UID. */
-function sealDirectories(directories, uid) {
-    runSetfacl(["-b"], directories);
-    for (const directory of directories)
-        chmodSync(directory, 0o500);
-    runSetfacl(["-m", `u:${uid}:r-X`], directories);
-}
-function clearBesideWorkspace(viewRoot) {
-    for (const name of readdirSync(viewRoot)) {
-        if (name !== "workspace") {
-            rmSync(join(viewRoot, name), { recursive: true, force: true });
-        }
-    }
-}

package/dist/subagents.d.ts

@@ -1,6 +0,0 @@
-export declare function materializeSubagent(h: HarnessId, name: string, sa: AgentSubagentProfile, plan: WorkspacePlan, add: AddPlanFile, unsupported: (d: Unsupported["dimension"], r: string) => void): void;
-export declare function codexAgentRoleName(resourceName: string): string | undefined;
-export declare function registerCodexAgent(plan: WorkspacePlan, name: string, configFile: string, description: string): void;
-import type { AgentSubagentProfile } from "@tangle-network/agent-interface";
-import type { AddPlanFile } from "./plan-json.js";
-import type { HarnessId, Unsupported, WorkspacePlan } from "./plan-types.js";

package/dist/subagents.js

@@ -1,137 +0,0 @@
-export function materializeSubagent(h, name, sa, plan, add, unsupported) {
-    if (!/^[a-z0-9][a-z0-9_-]*$/.test(name)) {
-        unsupported("subagents", `${h}: subagent name "${name}" must use lowercase letters, digits, underscores, or hyphens`);
-        return;
-    }
-    switch (h) {
-        case "claude-code":
-        case "nanoclaw": {
-            const fm = ["---", `name: ${name}`];
-            fm.push(`description: ${JSON.stringify(sa.description ?? name)}`);
-            if (sa.model)
-                fm.push(`model: ${JSON.stringify(sa.model)}`);
-            if (sa.tools) {
-                const tools = Object.entries(sa.tools);
-                const allowed = tools
-                    .filter(([, enabled]) => enabled)
-                    .map(([tool]) => tool);
-                const denied = tools
-                    .filter(([, enabled]) => !enabled)
-                    .map(([tool]) => tool);
-                if (allowed.length > 0)
-                    fm.push(`tools: ${JSON.stringify(allowed)}`);
-                if (denied.length > 0)
-                    fm.push(`disallowedTools: ${JSON.stringify(denied)}`);
-            }
-            if (sa.maxSteps !== undefined)
-                fm.push(`maxTurns: ${sa.maxSteps}`);
-            reportUnsupportedSubagentFields(h, name, sa, new Set(["description", "prompt", "model", "tools", "maxSteps"]), unsupported);
-            fm.push("---", "", sa.prompt ?? sa.description ?? name);
-            const relPath = `.claude/agents/${name}.md`;
-            add(relPath, markMaterializerSubagent(relPath, `${fm.join("\n")}\n`));
-            break;
-        }
-        case "opencode": {
-            const fm = [
-                "---",
-                `description: ${JSON.stringify(sa.description ?? name)}`,
-                "mode: subagent",
-            ];
-            if (sa.model)
-                fm.push(`model: ${JSON.stringify(sa.model)}`);
-            if (sa.tools)
-                fm.push(`tools: ${JSON.stringify(sa.tools)}`);
-            if (sa.permissions)
-                fm.push(`permission: ${JSON.stringify(sa.permissions)}`);
-            if (sa.maxSteps !== undefined)
-                fm.push(`steps: ${sa.maxSteps}`);
-            reportUnsupportedSubagentFields(h, name, sa, new Set([
-                "description",
-                "prompt",
-                "model",
-                "tools",
-                "permissions",
-                "maxSteps",
-            ]), unsupported);
-            fm.push("---", "", sa.prompt ?? "");
-            const relPath = `.opencode/agents/${name}.md`;
-            add(relPath, markMaterializerSubagent(relPath, `${fm.join("\n")}\n`));
-            break;
-        }
-        case "gemini": {
-            const tools = sa.tools
-                ? Object.entries(sa.tools)
-                    .filter(([, enabled]) => enabled)
-                    .map(([tool]) => tool)
-                : undefined;
-            reportUnsupportedSubagentFields(h, name, sa, new Set(["description", "prompt", "model", "tools", "maxSteps"]), unsupported);
-            const relPath = `.gemini/agents/${name}.md`;
-            add(relPath, markMaterializerSubagent(relPath, [
-                "---",
-                `name: ${name}`,
-                `description: ${JSON.stringify(sa.description ?? name)}`,
-                "kind: local",
-                ...(sa.model ? [`model: ${JSON.stringify(sa.model)}`] : []),
-                ...(tools ? [`tools: ${JSON.stringify(tools)}`] : []),
-                ...(sa.maxSteps !== undefined ? [`max_turns: ${sa.maxSteps}`] : []),
-                "---",
-                "",
-                sa.prompt ?? "",
-                "",
-            ].join("\n")));
-            break;
-        }
-        case "codex": {
-            const relPath = `.codex/agents/${name}.toml`;
-            const lines = [
-                `name = ${tomlStr(name)}`,
-                `description = ${tomlStr(sa.description ?? name)}`,
-                `developer_instructions = ${tomlStr(sa.prompt ?? sa.description ?? name)}`,
-            ];
-            if (sa.model)
-                lines.push(`model = ${tomlStr(sa.model)}`);
-            reportUnsupportedSubagentFields(h, name, sa, new Set(["description", "prompt", "model"]), unsupported);
-            add(relPath, markMaterializerSubagent(relPath, `${lines.join("\n")}\n`));
-            registerCodexAgent(plan, name, relPath, sa.description ?? name);
-            break;
-        }
-        case "prime":
-            // Prime subagents ARE expressible — as entries in the continual-harness
-            // store at <agentDir>/harness/harness_state.json (fork refinement.ts:269-279,
-            // re-read on every system-prompt build: agent-session.ts:7548-7554) — but
-            // that store lives under the executor-owned agent dir, which no
-            // workspace-relative plan file can reach. Executors that own the agent
-            // dir seed it with seedPrimeProfileSubagents; the plan stays fail-closed
-            // so a plan-forwarding caller can never believe the roster is in force.
-            unsupported("subagents", `prime: subagents live in the agent-dir continual-harness store (<agentDir>/harness/harness_state.json), outside any workspace plan — seed "${name}" with seedPrimeProfileSubagents from the executor that owns the agent dir`);
-            break;
-        default:
-            unsupported("subagents", `${h}: subagents have no cwd file (config/flag/global only); "${name}" not mounted`);
-    }
-}
-export function codexAgentRoleName(resourceName) {
-    const name = resourceName.endsWith(".toml")
-        ? resourceName.slice(0, -".toml".length)
-        : resourceName;
-    return /^[a-z0-9][a-z0-9_-]*$/.test(name) ? name : undefined;
-}
-export function registerCodexAgent(plan, name, configFile, description) {
-    plan.flags.push("-c", `agents.${name}.description=${tomlStr(description)}`, "-c", `agents.${name}.config_file=${tomlStr(configFile)}`);
-}
-function reportUnsupportedSubagentFields(harness, name, subagent, supported, unsupported) {
-    for (const field of [
-        "description",
-        "prompt",
-        "model",
-        "tools",
-        "permissions",
-        "maxSteps",
-        "metadata",
-    ]) {
-        if (subagent[field] !== undefined && !supported.has(field)) {
-            unsupported("subagents", `${harness}: subagent "${name}" does not support ${field}`);
-        }
-    }
-}
-import { markMaterializerSubagent } from "./harness.js";
-import { tomlStr } from "./plan-json.js";

package/dist/tool-bin-path.d.ts

@@ -1,23 +0,0 @@
-/** The colon-separated, absolute CLI bin dirs a sandbox app mounts for its tools. */
-export declare const SANDBOX_TOOL_BIN_DIRS_ENV = "SANDBOX_TOOL_BIN_DIRS";
-/**
- * The tool bin dirs a `SANDBOX_TOOL_BIN_DIRS` value names, or `[]` when it is
- * unset or blank.
- *
- * Fail loud, never silently degrade: a malformed value (a relative segment,
- * or an empty segment from a stray/leading/trailing colon) throws rather than
- * silently dropping a tool dir from PATH or admitting a relative path that
- * resolves against whatever the process cwd happens to be.
- */
-export declare function parseSandboxToolBinDirs(value: string | undefined): string[];
-/**
- * A launch environment whose tool bin dirs are `toolBinDirs`, at the TAIL of
- * PATH after every Nix, npm, image and system entry, so a tool never shadows
- * a platform-owned binary of the same name.
- *
- * They replace `appToolBinDirs` (by default the dirs the environment's own
- * `SANDBOX_TOOL_BIN_DIRS` names) wherever those sit in PATH, so an app's older
- * copy of the same tool cannot win by PATH order. Relative PATH entries are
- * dropped too: they resolve against whatever cwd the turn moves to.
- */
-export declare function bindLaunchToolBinDirs(env: Readonly<Record<string, string | undefined>>, toolBinDirs: readonly string[], appToolBinDirs?: readonly string[]): Record<string, string | undefined>;

package/dist/tool-bin-path.js

@@ -1,61 +0,0 @@
-import { isAbsolute } from "node:path";
-/** The colon-separated, absolute CLI bin dirs a sandbox app mounts for its tools. */
-export const SANDBOX_TOOL_BIN_DIRS_ENV = "SANDBOX_TOOL_BIN_DIRS";
-/**
- * The tool bin dirs a `SANDBOX_TOOL_BIN_DIRS` value names, or `[]` when it is
- * unset or blank.
- *
- * Fail loud, never silently degrade: a malformed value (a relative segment,
- * or an empty segment from a stray/leading/trailing colon) throws rather than
- * silently dropping a tool dir from PATH or admitting a relative path that
- * resolves against whatever the process cwd happens to be.
- */
-export function parseSandboxToolBinDirs(value) {
-    const trimmed = value?.trim();
-    if (!trimmed)
-        return [];
-    const segments = trimmed.split(":");
-    for (const segment of segments) {
-        if (!segment || !isAbsolute(segment)) {
-            throw new Error(`SANDBOX_TOOL_BIN_DIRS must be a colon-separated list of absolute paths with no empty segments, got: ${trimmed}`);
-        }
-    }
-    return segments;
-}
-function assertToolBinDir(dir) {
-    // A ':' would split one declared dir into several PATH entries, admitting
-    // a dir no profile declared.
-    if (!dir || !isAbsolute(dir) || dir.includes(":")) {
-        throw new Error(`a tool bin dir must be an absolute path without ':', got: ${dir}`);
-    }
-}
-/**
- * A launch environment whose tool bin dirs are `toolBinDirs`, at the TAIL of
- * PATH after every Nix, npm, image and system entry, so a tool never shadows
- * a platform-owned binary of the same name.
- *
- * They replace `appToolBinDirs` (by default the dirs the environment's own
- * `SANDBOX_TOOL_BIN_DIRS` names) wherever those sit in PATH, so an app's older
- * copy of the same tool cannot win by PATH order. Relative PATH entries are
- * dropped too: they resolve against whatever cwd the turn moves to.
- */
-export function bindLaunchToolBinDirs(env, toolBinDirs, appToolBinDirs = parseSandboxToolBinDirs(env[SANDBOX_TOOL_BIN_DIRS_ENV])) {
-    for (const dir of toolBinDirs)
-        assertToolBinDir(dir);
-    const dirs = [...new Set(toolBinDirs)];
-    // No PATH to bind: the spawner appends SANDBOX_TOOL_BIN_DIRS to its default.
-    if (env.PATH === undefined) {
-        return { ...env, [SANDBOX_TOOL_BIN_DIRS_ENV]: dirs.join(":") };
-    }
-    const replaced = new Set(appToolBinDirs);
-    const entries = env.PATH.split(":").filter((entry) => isAbsolute(entry) && !replaced.has(entry));
-    for (const dir of dirs) {
-        if (!entries.includes(dir))
-            entries.push(dir);
-    }
-    return {
-        ...env,
-        PATH: entries.join(":"),
-        [SANDBOX_TOOL_BIN_DIRS_ENV]: dirs.join(":"),
-    };
-}